In the sixth-generation fixed network (F6G), network security becomes an important topic. Encryption is an effective method to prevent network attacks and realize network security. Quantum key distribution (QKD) is a promising technology to effectively address the challenge by providing secret keys due to the laws of quantum physics. New services such as high immersion experience and holographic have the characteristics of time-varying bandwidth and requirements. The introduction of optical service unit (OSU) technology makes it possible to provide the exact bandwidth used by the service. In optical transport networks, a lightpath needs to be established before service transmission, and will be removed after service transmission. Signaling is used for lightpath establishment, removal, and bandwidth adjustment. Data information transmitted in data layer and signaling information transmitted in control layer are highly vulnerable to cyberattacks, such as eavesdropping. The supply of bandwidth and key resources need to be optimized to achieve secure and stable service transmission in optical networks. Hence, how to realize bandwidth and key on demand (BKoD) provisioning for dynamic services is a key problem. To improve the flexibility of bandwidth and key resource allocation and utilization, a QKD-secured OSU-based optical transport network can be deployed. In this paper, a novel QKD-secured OSU-based optical transport network architecture is proposed and a service aware dynamic resource provisioning (SADRP) algorithm is proposed to realize BKoD. The proposed architecture uses the QKD technique to provide keys for both signaling information and data information for the first time. The proposed algorithm supplies resources according to the dynamic demand of bandwidth and key, so as to achieve the balance between dynamic demand and static resource utilization. Simulations results show that compared with the benchmark algorithm, the SADRP algorithm reduces blocking probab...